BonfireSwap exploit analysis

BonfireSwap on BNB Chain was used to force-sell ~65 BONFIRE holders on 2026-09-15, netting the attacker ~66 BNB (~$47-50K) (attack transaction, block 122003954). DeFiHackLabs reconstructs the force-sell against the verified BonfireSwap router and token source on a BSC fork and reproduces the BNB leg of the 5 largest real victims (~99% of the drain).

BonfireSwapRouter.transfer(address to, uint amountAIn, address beneficiary, uint deadline) calls _safeTransferFrom(tokenAddress, to, pancakePair, amountAIn) and then skimPools(beneficiary). _safeTransferFrom does token.call(transferFrom(from=to, pair, amount)) with no msg.sender == to check and no check that the caller has any allowance from to. The pull succeeds purely on the allowance to itself granted the router earlier, from legitimate prior use of the router's standard swap. simpleTransfer() and loggedTransfer() share the same _safeTransferFrom(tokenAddress, to, ...) pattern and are equally exploitable; the real attack used the plain transfer() path.

The dumped tokens land in the Pancake pair, the router's pools[0]. The skimPools() inside transfer() skims the freshly-dumped excess straight back out to beneficiary as BONFIRE, so the value is realized at the second step when the attacker calls sell() on the accumulated BONFIRE for WBNB. DeFiHackLabs's reproduction uses two sell() calls that returned 33.22 + 32.86 = 66.08 WBNB, matching the ~66 BNB figure across the full attack.

The fix is to require msg.sender == to in _safeTransferFrom, or to consume a per-holder allowance rather than the holder's standing one.